Develop a security and compliance plan →hardMultiple SelectObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Your organization uses Azure Key Vault to store secrets and certificates used in Azure Pipelines. You need to implement a security and compliance plan that ensures secrets are rotated automatically and access is audited. Which THREE actions should you take?

⚠ Common exam trap

Test-takers frequently confuse resource locks (Option B) with soft-delete/purge protection, thinking that a resource lock alone satisfies compliance requirements, but it does not provide the recovery and audit capabilities required for secret rotation and access auditing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable soft-delete and purge protection on the Key Vault.

Enabling soft-delete and purge protection ensures deleted secrets and certificates can be recovered and permanent deletion is blocked, which is important for compliance and recovery. Using a managed identity for Azure Pipelines removes the need to store and rotate credentials, and each access is tied to a known identity, enabling access auditing. Configuring certificate auto-rotation with a specified lifetime ensures secrets are rotated automatically. Together, these actions address recovery, secure access, and automatic rotation as required.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable soft-delete and purge protection on the Key Vault.
Why this is correct
Soft-delete and purge protection are critical for compliance to recover deleted secrets and prevent permanent loss.
✗
Use a resource lock on the Key Vault to prevent deletion.
Why it's wrong here
A resource lock prevents deletion or modification of the Key Vault at the Azure Resource Manager level, but it does not automate secret or certificate rotation, enforce least privilege, or provide audited access controls. It also cannot recover deleted keys, secrets, or certificates, so it fails to address data-loss compliance requirements that soft-delete and purge protection fulfill.
✗
Use a Key Vault access policy to grant developers full access.
Why it's wrong here
Granting developers full Key Vault access violates the principle of least privilege and lets them read, update, or delete secrets and certificates beyond what is required for pipeline or application operation. It introduces a security risk and does not automate certificate rotation or provide compliance-grade auditing, making it an incorrect choice for secure secret management.
✓
Use Managed Identity to authenticate Azure Pipelines to Key Vault.
Why this is correct
Using a Managed Identity lets Azure Pipelines authenticate to Key Vault without storing service principal credentials or client secrets in pipeline variables or variable groups. The pipeline agent or service connection obtains a token from Microsoft Entra ID (formerly Azure AD), and access is controlled via Key Vault access policies, reducing credential exposure and simplifying secret management.
✓
Configure Key Vault certificate auto-rotation with a specified lifetime.
Why this is correct
Key Vault certificate auto-rotation with a specified lifetime automatically renews and rotates certificates before their expiry, using the certificate's validity period and renewal action. This ensures certificates are regularly replaced without manual intervention, directly supporting compliance requirements for certificate lifecycle management and minimizing the risk of expired certificates.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question